The abilities and advancements of Internet Technology are constantly evolving and growing. For corporations, this is as much a blessing as it is a curse. As the old saying goes, ‘with great power comes great responsibility.’ Look at any given corporation; most likely every department is in some way using IT to improve current processes, assist in financial reporting, expand and create new processes, etc. Given the extensive use of the advanced IT capabilities of today, a need for the IT security objectives and business objectives to align is created. The Information Technology Governance Institute (ITGI) illustrates this best in the statement, “While many organizations recognize the potential benefits that technology can yield, the successful ones also understand and manage the risks associated with implementing new technologies.” This is where IT Governance comes in to play. As highlighted in Dr. Steven Hornik’s September 22nd presentation on frameworks, there is a disconnect between the need for IT Governance and the practices of corporate executives. This research paper will be geared toward the education of corporate executives on IT Governance, various frameworks available for use, and the importance of knowledge and implementation due to accounting regulations. There will be 4 key elements covered: Introduction to Enterprise and IT Governance and the frameworks available, the importance of integrating accounting compliance regulations with IT security due to the Sarbanes-Oxley (SOX) act, a compare and contrast of the top frameworks with a compiled list of best practices from all the various frameworks, and finally a recommendation to executives.

PART I.
Stakeholders becoming increasingly concerned about the sound management of their interests have led to the emergence of governance principles and standards for overall enterprise governance. (Board Briefing on IT Governance) ITGI defines Enterprise (Corporate) Governance as, “a set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise’s resources are used responsibly.” Widely used frameworks for enterprise governance due to requirement for SOX compliance are the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO’s) Internal Control – Integrated Framework or Enterprise Risk Management – Integrated Framework. A key component of the IT governance framework selected is its cohesiveness with the organization’s enterprise governance framework.
As noted in the introduction, for basically all organizations, IT is fundamental to support, sustain and grow the business. (ITGI) Along with the benefits of Information Technology, comes the risks and need to manage these risks. Given the extensive and critical impact of IT on the organization, IT Governance should not be a separate set of objectives and principles followed by only a certain group of the organization; it should be an integrated part aligned with the overall Enterprise Governance practices. As a result, IT Governance is accurately defined by the ITGI as “the leadership, organizational structures, and processes that ensure that the enterprise’s IT sustains and extends the enterprise’s strategies and objectives”.
Establishing an IT Governance process begins with identifying the IT objectives and principles the organization wishes to implement, the risks they wish to manage as well as the regulations they may legally be required to follow. All of these factors will assist in determining which framework they chose. Key business leaders have two broad options in framework selection: adopt a standard framework or create a framework based on best practices of these standard frameworks developed over the years. We will introduce several of the major frameworks then later compare the strengths and weaknesses of each to create a best practices framework as an organization may wish to do. Widely considered the leading IT governance and control framework with acceptance even spanning internationally, Control Objectives for Information and related Technology (COBiT) is an experienced framework originally established in 1996 by the Information Systems Audit and Control Association (ISACA). Since the original released version, there have been four editions and is now published by ITGI. As defined by ITGI, COBIT is an IT governance framework and supporting toolset that allows managers to bridge the gap between control requirements, technical issues and business risks. “In particular, COBIT’s Management Guidelines component contains a framework responding to management’s need for control and measurability of IT by providing tools to assess and measure the enterprise’s IT capability for the 34 COBIT IT processes.” (ISACA.ORG) The tools include: (1) Performance measurement elements (outcome measures and performance drivers for all IT processes) (2) A list of critical success factors that provides succinct, nontechnical best practices for each IT process (3) Maturity models to assist in benchmarking and decision-making for capability improvements (ISACA.ORG) The passing of the Sarbanes-Oxley act further increased popularity of this framework as it is commonly known as the preferred framework for auditors. The tools and guidelines used to achieve control and measurability of IT assist organizations in meeting the requirements of SOX. We will further discuss this importance later on in the paper. Additionally, COBiT fits with and Supports COSO’s Framework, a key element for enterprise governance and IT governance cohesiveness. Another mature and internationally preferred framework is IT Infrastructure Library (ITIL). Originally developed in the 1980’s by the UK Government for their own use, ITIL has evolved and expanded across the world despite some criticisms due to governmental ownership. The key focus is Service Management. ITIL covers the organizational structure and skill requirements for an IT organization/area by presenting a comprehensive set of management procedures. These are intended to be supplier independent and apply to all aspects of IT infrastructure. (IT GOVERNANCE.politicalinfo…) ITIL’s structure consists of a collection of 8 books: Service Delivery, Service Support, Planning to Implement Service Management, ICT Infrastructure Management, Software Asset Management, The Business Perspective, Security Management, and Application Management. While ITIL is an excellent tool, many claim it is not sufficient for complete IT compliance with SOX due to its lack of focus on control. Ross Armstrong in his article SOX and ITIL: There Is No Dotted-Line Relationship!: “However, ITIL does not address governance in a comprehensive way and cannot be used on its own to ensure SOX compliance. This is largely because ITIL is heavily focused on the help desk and “IT as a service” and not on control objectives.”

The last major frameworks we will cover are the ISO 17799 and ISO/IEC 27001 which are complementing counter-parts for each other and certification in both ensures a certain level of compliance in the several layers and categories. ISO 17799 was originally published over a decade ago by a government department in the UK with a focus on information security and controls. From there it was published as BS7999 and eventually as ISO 17799 by the International Organization for Standardization (ISO) in December 2000 (IT GOVERNANCE.politicalinfo…) It was also later re-published in 2005 with a few updates due to technological advances. In 2002, BS7799-2 was published with a focus on information security systems. Following the ISO 17799 2005 revision, BS7799-2 became the ISO standard, ISO 27001. The main focus of the ISO standards is to serve as a single reference point for identifying a range of controls needed for most situations where information systems are used in industry and commerce (CIOINDEX) Depending upon the versions of these standards used, there are approximately ten to twelve sections: Security Policy, Organization of Information Security, Asset Classification, Human Resources Security, Physical and Environmental Security, Communications and Operations Management, Access Control, Systems Development, Business Continuity Management, Compliance, Risk Assessment, and IS Acquisition. A key component of the ISO standards is the ability for the Information Systems Management System to be certified as compliant by a third-party accredited certification body. The article Information Security and Sarbanes-Oxley
Compliance:An Exploratory Study states, “Prior research has suggested that organizations who implement the controls outlined by ISO 17799 will be “well on their way” toward complying with the security mandates of SOX.” Next, we will explore the importance of the framework selected to promote SOX compliance.